Homomorphic white box system and method for using same

ABSTRACT

A method for whitebox cryptography is provided for computing an algorithm  (m,S) with input m and secret S, using one or more white-box encoded operations. The method includes accepting an encoded input c, where c=Enc(P,m); accepting an encoded secret S′, where S′=Enc(P,S); performing one or more operations on the encoded input c and the encoded secret S′ modulo N to obtain an encoded output c′; and decoding the encoded output c′ with the private key p to recover an output m′ according to m′=Dec(p,c′), such that m′= (m,S).

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims benefit of U.S. Provisional Patent ApplicationNo. 62/443,926 entitled “CANDIDATE FULLY HOMOMORPHIC WHITE BOX SYSTEM,”by Lex Aaron Anderson, Alexander Medvinsky, and Rafie Shamsaasef, filedJan. 9, 2017, which application is hereby incorporated by referenceherein.

BACKGROUND 1. Field of the Invention

The present invention relates to systems and methods for performingcryptographic operations, and in particular to a system and method forsecurely performing homomorphic cryptographic operations.

2. Description of the Related Art

The goal of much of cryptography is to allow dissemination ofinformation in such a way that prevents disclosure to unauthorizedentities. This goal has been met using cryptographic systems (such asthe Advanced Encryption Standard (AES), Triple Data Encryption Standard(TDES), Rivest-Shamir-Adleman (RSA), Elliptic-Curve Cryptography (ECC))and protocols.

In the systems implementing such cryptographic systems, it is assumedthat the attacker only has access to the input and output of thealgorithm performing the cryptographic operation, with the actualprocessing being performed invisibly in a “black box.” For such a modelto comply, the black box must provide a secure processing environment.Active research in this domain includes improved and special purposecryptographic systems (e.g., lightweight block ciphers, authenticationschemes, homomorphic public key algorithms), and the cryptanalysisthereof.

While such systems are effective, they are still vulnerable to attack.For example, protocols may be deployed in the wrong context, badlyimplemented algorithms, or inappropriate parameters may introduce anentry point for attackers.

New cryptanalysis techniques that incorporate additional side-channelinformation that can be observed during the execution of a cryptoalgorithm; information such as execution timing, electromagneticradiation and power consumption. Mitigating such side channel attacks isa challenge, since it is hard to de-correlate this side-channelinformation from operations on secret keys. Moreover, the platform oftenimposes size and performance requirements that make it hard to deployprotection techniques.

Further exacerbating the foregoing problems, more applications are beingperformed on open devices with general purpose processors (e.g. personalcomputers, laptops, tablets, and smartphones) instead of devices havingsecure processors.

In response to the foregoing problems, many systems use “white-box”techniques, in which it is assumed that the attacker has full access tothe software implementation of a cryptographic algorithm: the binary iscompletely visible and alterable by the attacker, and the attacker hasfull control over the execution platform (CPU calls, memory registers,etc.). In such systems, the implementation itself is the sole line ofdefense.

White-box cryptography was first published by Chow et al. (Stanley Chow,Philip A. Eisen, Harold Johnson, and Paul C. van Oorschot. A white-boxDES implementation for DRM applications. In Proceedings of the ACMWorkshop on Security and Privacy in Digital Rights Management (DRM2002), volume 2696 of Lecture Notes in Computer Science, pages 1-15.Springer, 2002, hereby incorporated by reference herein). This addressedthe case of fixed key white-box DES implementations. The challenge is tohard-code the DES symmetric key in the implementation of the blockcipher. The main idea is to embed both the fixed key (in the form ofdata but also in the form of code) and random data (instantiated atcompilation time) in a composition from which it is hard to derive theoriginal key.

The goal of a white-box attacker is to recover the secret from awhite-box implementation. Typically, white-box cryptography isimplemented via lookup tables encoded with bijections. Since thesebijections are randomly chosen, it is infeasible for an attacker tobrute-force the encodings for a randomly chosen secret from asufficiently large keyspace.

Further, code footprints present a significant problem for typicalwhite-box implementations, which use lookup tables to replacemathematical operations with encoded mathematical operations. Forexample, if a single operation is to be performed using two one byte (8bit) numbers, the lookup table will comprise 2⁸ or 256 rows and 256columns (0 to 255), and will therefore comprise 64K bytes of informationthat must be stored. Further, computations performed on larger numberssubstantially increase storage requirements. For example, if a singleoperation is to be performed using two 16 bit numbers, the lookup tablewill comprise 2¹⁶*2¹⁶ rows and columns of 16 bit numbers, which requiresmore than 8.6 gigabytes of storage. Given that typically more than onecryptographic operation is required and that computations may need to beperformed in 32 or 64 bits, it can be seen that classicallookup-table-based white-box implementations are not suited toapplications that are based on large integers. Further, while the sizeof the lookup tables may be reduced by breaking cryptographiccomputations down into smaller integers, a greater number of lookuptables will be required. For example, it has been estimated that toperform RSA computations in a white-box implementation, several thousandone-byte lookup tables would be required.

What is needed is a way to efficiently perform large integercryptographic operations offering the advantages of white-boximplementations that do not expose secrets to compromise, whileminimizing the storage and processing requirements of suchimplementations.

SUMMARY

To address the requirements described above, the present inventiondiscloses a method and apparatus for computing an algorithm

(m,S) with input m and secret S, using one or more white-box encodedoperations. In one embodiment, the method comprises defining a white-boxfully-homomorphic key generation function (P,p)←Gen(1^(w)) withpublic-key P and private-key p that selects random prime numbers p, q,s∈W of similar size, wherein: B={0,1}^(b) is the domain of order b, ofthe algorithm

; W=[0,1]^(w) is a white-box domain of order w, for w»b; p>2^(b) is awhite-box fully-homomorphic private key, N=pq, k=s(p−1); and P=(N,k) isa white-box fully-homomorphic public key. The method also comprisesdefining a white-box fully-homomorphic encoding functionEnc(P,m):=m^(rk+1)(mod N) that generates a random integer r∈W, thenperforms an encoding of the input m∈B; and defining a white-boxfully-homomorphic decoding function Dec(p,c):=c(mod p) that decodes c bycomputing c modulo p. Finally, the method also comprises accepting anencoded input c, where c=Enc(P,m); accepting an encoded secret S′, whereS′=Enc(P,S); performing one or more operations on the encoded input cand the encoded secret S′ modulo N to obtain an encoded output c′; anddecoding the encoded output c′ with the private key p to recover anoutput m′ according to m′=Dec(p,c′), such that m′=

(m,S).

Other embodiments are evidenced by an apparatus having a processorcommunicatively coupled to a memory storing processor instructions forperforming the foregoing operations.

The foregoing allows white-box implementations that are tunable tomaximize performance if needed or to achieve security strength asrequired. It is applicable for direct application to general-purposeprogram code, thus reducing the expertise required to build andintegrate white-box implementations, while also diminishing theincidence of implementation weaknesses through automation.

BRIEF DESCRIPTION OF THE DRAWINGS

Referring now to the drawings in which like reference numbers representcorresponding parts throughout:

FIGS. 1A and 1B are diagrams of a cryptographic system processing aninput message to produce an output message, and its correspondingwhite-box implementation;

FIG. 2 is a diagram illustrating exemplary operations that can beperformed to implement one embodiment of a fully homomorphic white-boximplementation (FHWI);

FIG. 3 is a diagram illustrating one embodiment of a key generator forgenerating a private key p and a public key P;

FIG. 4 is a diagram illustrating one embodiment of a fully homomorphicwhite-box implementation;

FIG. 5 is a diagram presenting a tabular comparison of processing timesfor the baseline white-box implementation illustrated in FIG. 1B, andthe FHWI implementation shown in FIG. 4;

FIG. 6 is a diagram presenting a tabular comparison of the memoryfootprint required to implement the baseline white-box implementationillustrated in FIG. 1B and the FHWI implementation illustrated in FIG.4; and

FIG. 7 is a diagram illustrating an exemplary computer system that couldbe used to implement elements of the present invention.

DETAILED DESCRIPTION

In the following description, reference is made to the accompanyingdrawings which form a part hereof, and which is shown, by way ofillustration, several embodiments of the present invention. It isunderstood that other embodiments may be utilized and structural changesmay be made without departing from the scope of the present invention.

Overview

A fully homomorphic white-box implementation of one or morecryptographic operations is presented below. This method allowsconstruction of white-box implementations from general-purpose codewithout necessitating specialized knowledge in cryptography, and withminimal impact to the processing and memory requirements fornon-white-box implementations. This method and the techniques that useit are ideally suited for securing “math heavy” implementations, such ascodecs, that currently do not benefit from white-box security because ofmemory or processing concerns. Further, the fully homomorphic white-boxconstruction can produce a white-box implementation from general purposeprogram code, such as C or C++.

In the following discussion, the terms “encoding,” “decoding,”“encoder,” and “decoder,” are used to generally describe such performedoperations as being possible to implement in smaller domains. Theprinciples discussed herein may also be applied without loss ofgenerality to larger domains, and in such applications, the operationsmay be classified as “encrypting” and “decrypting.”

White-Box Cryptographic Systems

A white-box system operates by encoding data elements (such as secretkeys) so that they cannot be recovered by an attacker in their cleartextform. A white-box implementation is generated with mathematicallyaltered functions that operate directly on the encoded data elementswithout decoding them. This guarantees that the secrets remain encodedat all times, thus protecting the implementation against attackers withfull access to and control of the execution environment. This isdescribed, for example, in the Chow reference cited above.

FIGS. 1A and 1B are diagrams of a cryptographic system processing aninput message to produce an output message, and its correspondingwhite-box implementation.

As illustrated in FIG. 1A, the algorithm performs functions ƒ₁, ƒ₂ andƒ_(n) (102A, 102B, and 102N, respectively) when provided with an inputand secret S.

In FIG. 1B, each operation ƒ₁, ƒ₂, . . . , ƒ_(n) in an originalalgorithm

(m,S) with input message m and secret S is encoded as a lookup-table T₁,T₂, . . . , T_(n) (104A, 104B, and 104N, respectively) in the classicalwhite-box implementation of that algorithm. The encodings are generatedas two sequences of random bijections, δ₁, δ₂, . . . , δ_(n+1) that areapplied to the inputs and output of each operation, where ρ(S)represents an encoded secret (e.g. a secret key), which is either linkedstatically or provided dynamically to the white-box implementation.

In the white-box implementation shown in FIG. 1B this is implemented byapplying bijections δ₁ and ρ(S) as an input to lookup table T₁ to obtainan intermediate output, applying the intermediate output and ρ(S) tolookup table T₂ to produce a second intermediate output, then providingthe second intermediate output and ρ(S) to lookup table T₃ to produceoutput δ_(n+1) ⁻¹(⋅). Lookup table T₁ inverts the bijection δ₁ of theinput by δ₁ ⁻, inverts the bijection ρ of S(ρ(S)) by ρ₁ ⁻¹, applies ƒ₁and then applies bijection δ₂ to produce the first intermediate output.Similarly, lookup table T₂ inverts the bijection δ₂ of the firstintermediate input by δ₂ ⁻¹, inverts the bijection ρ of S(ρ(S)) by ρ₂⁻¹, applies ƒ₂ and then applies bijection δ₃ to produce the firstintermediate output. Generally, final lookup table T_(n) inverts thebijection δ_(n) of the n−1^(th) intermediate input by δ_(n) ⁻¹, invertsthe bijection ρ of S(ρ(S)) by ρ_(n) ⁻¹, applies ƒ_(n) and then appliesbijection δ_(n+1) to produce the intermediate output δ_(n+1) ⁻¹(⋅).

White-box implementations are usually of cryptographic primitives (suchas the advanced encryption standard or AES) and chains of cryptographicprimitives used in cryptographic protocols (such as elliptic curveDiffie-Hellman key exchange, or ECDHE). Designing and coding theseimplementations requires specialist knowledge of white-box cryptographyto attain the best possible security properties. Just as importantly,integration with white-box implementations also requires a degree ofspecialist knowledge to avoid common pitfalls that can negate thewhite-box security.

Public Key Cryptography

Public key encryption schemes use a pair of keys: a public key which maybe disseminated widely, and a private key which are known only to theowner. The message is encrypted according to the public key, and thepublic key is publicly shared. However, decrypting the message requiresthe private key, which is only provided to authorized recipients of theencrypted data. This accomplishes two functions: authentication andencryption. Authentication is accomplished because the public key can beused to verify that a holder of the paired private key sent the message.Encryption is accomplished, since only a holder of the paired privatekey can decrypt the message encrypted with the public key.

A public-key encryption scheme is a triple (Gen, Enc, Dec), with aprobabilistic-polynomial-time (PPT) key-pair generator algorithm Gen,PPT encryption algorithm Enc and PPT decryption algorithm Dec, such thatfor any public/private key-pair (e,d)←Gen(

) and all messages m of length

it holds that m=Dec(d,Enc(e,m)).

Homomorphic Cryptographic Operations

Fully homomorphic encryption schemes preserve underlying algebraicstructure, which allows for performing operations in an encrypted domainwithout the need for decryption, as described in “On data banks andprivacy homomorphisms,” by Ronald L Rivest, L Adleman, and M LDertouzos, Foundations of Secure Computation, 32(4):169-178, 1978, whichis hereby incorporated by reference herein.

As used herein, a fully homomorphic encryption scheme is an encryptionscheme with the following property: Given two encryption operationsEnc(e,m₁) and Enc(e,m₂), where m₁ and m₂ are two messages encrypted witha chosen public key e, one can efficiently and securely computec=Enc(e,m₁⊙m₂)=Enc(e,m₁)⊙Enc(e,m₂) without revealing m and m₂, such thatDec(d,c)=m₁⊙m₂, wherein the operation ⊙ is multiplication or addition.

Thus, homomorphic cryptography is a form of cryptography that permitscomputation on encrypted data or ciphertexts, which, when decrypted,provides the same result as would have been provided if the computationswere performed on the unencrypted or plaintext. Hence, homomorphiccryptography permits the performance of one or more cryptographicoperations, while not exposing the secrets used in such operations.

White-Box Fully Homomorphic Cryptographic Processing

A number-theoretic white-box encoding scheme that is suited toarithmetic operations in common use in software applications ispresented below. The encoding scheme is based on Fermat's LittleTheorem, which states that if p is a prime number and if α is anyinteger not divisible by p, then α^(p−1)−1 is divisible by p.

A white-box fully homomorphic encoding scheme (WBFHE) can be defined asfollows. Let B=0, 1^(b), b≥8 be the integral domain of the arithmeticoperations in the original algorithm (e.g. the one or more operationsdepicted in FIG. 1A). The term b represents the order of the integraldomain. For example, if b=8, integral domain B consists of 2⁸ possiblevalues. Further, let W=0, 1^(w), w»b be the white-box domain, such thatEnc: W×B→W is a WBFHE encoding and Dec: W×W→B is a WBFHE decoding. Theterm w refers to the order of the white-box domain. For example, ifw=1000, the white-box domain includes 2¹⁰⁰⁰ possible values.

Three functions (Gen, Enc, and Dec) are defined. The Gen functionselects three random prime integers p, q, s∈W of similar size (e.g. sameorder of magnitude), where p>2^(b) is the private key. Let N=pq and letk=s(p−1) such that P=(N,k) is a public key, where keypair generation isdenoted by:(P,p)←Gen(1^(w))  Equation (1)

The Enc function generates a random integer r∈W, then an encoding ofinput message m∈B is defined as:c=Enc(P,m):=m ^(rk+1)(mod N)  Equation (2)

The decoding function decodes c to recover an encoded message m bycomputing c modulo p as follows:m=Dec(p,c)=c(mod p)  Equation (3)

The order w of the white-box domain W is a parameter that can beadjusted or tuned to increase or decrease security to obtain the desiredlevel of performance from the white box implementation. If w issufficiently large, then WBFHE can be considered an encryption schemewith semantic security, as described below.

The foregoing WBFHE is multiplicatively and additively homomorphic.These properties can be validated as follows:

Let (P,p)←Gen(1^(w)) and choose m₁, m₂∈B. If the following encryptionsare computed:c ₁ =Enc(P,m ₁)=m ^(r) ¹ ^(k+1)(mod N)=m ₁ ^(r) ¹ ^(s(p−1)+1)(modN)  Equation (4)c ₂ =Enc(P,m ₂)=m ^(r) ² ^(k+1)(mod N)=m ₂ ^(r) ² ^(s(p−1)+1)(modN)  Equation (5)

It can be shown that:m ₁ m ₂ =Dec(p,c ₁ c ₂)=c ₁ c ₂(mod p)  Equation (6)andm ₁ +m ₂ =Dec(p,c ₁ +c ₂)=c ₁ +c ₂(mod p)  Equation (7)

For example, consider a small integer domain for purposes ofillustration where:

message one=m₁=8

message two=m₂=11

private key=p=101

first random integer=r₁=219

second random integer=r₂=112 and

third random prime number s=97

Substituting these values into Equations (6) and (7), respectivelyyields Equations (8) and (9) below:4250=Enc(P,m ₁)=m ^(r) ¹ ^(k+1)(mod N)=m ₁ ^(219*97(101−1)+1)(mod8989)  Equation (8)2132=Enc(P,m ₂)=m ^(r) ² ^(k+1)(mod N)=m ₂ ^(112*97(101−1)+1)(mod8989)  Equation (9)

Homomorphic addition can be shown because:m ₁ +m ₂ =Dec(p,m ₁ +m ₂)=4250+2132(Mod 101)  Equation (10)8+11=6382(mod 101)19=19  Equation (11)

Homomorphic multiplication can be shown because:m ₁ *m ₂ =Dec(p,m ₁ *m ₂)=4250*2132(Mod 101)  Equation (12)8*11=9061000(mod 101)88=88  Equation (13)

Further, since the foregoing white-box implementation is bothmultiplicatively and additively homomorphic, it is fully homomorphic.

FIG. 2 is a diagram illustrating exemplary operations that can beperformed to implement one embodiment of a fully homomorphic white-boximplementation. FIG. 2 will be discussed in conjunction with FIGS. 3 and4, which depict one embodiment of a key pair generator 300 and a fullyhomomorphic white-box implementation 400 corresponding to the processingsystem depicted in FIG. 1A, respectively.

Turning first to FIG. 2, block 210 encodes an input message m to computean encoded input c. This can be accomplished using encoder 404 depictedin FIG. 4 according to Equation (2) above.

The private key p and public key P=(N,k) is generated by the key pairgenerator 300 depicted in FIG. 3, which comprises a random numbergenerator (RNG) 302 for generating random prime numbers p, q and s suchthat p, q, s∈0,1^(w). The key generator 300 provides the random primenumber p as the private key and a public key P=(N,k) computed as a tupleof N by element 308, and N is a product of random prime numbers p and q(as computed by multiplication element 304) and k=s(p−1), as computed byelement 306. The factor r in Equation (2) is a random integer that neednot be prime.

Turning again to FIG. 2, block 212 encodes a secret S to compute anencoded secret S′. This can be accomplished by using encoder 404′depicted in FIG. 4 according to Equation (2), with the Enc function isperformed on secret S. The factor r used to compute encoded secret S′ isa random integer that need not be prime. This second random integer maybe generated by a random integer generator in the encoder 404′illustrated in FIG. 4, or may be generated by the random numbergenerator 302 of the key pair generator 300 illustrated in FIG. 3 andprovided to the encoder 404′.

Returning to FIG. 2, the encoded input c and the encoded secret S′ aretransmitted from the transmitter 202 to the receiver 204, as shown inblock 214. The receiver 204 accepts the transmitted encoded input c andthe transmitted encoded secret S′, as shown in block 216, and performsone or more cryptographic operations according to the encoded inputmessage c and the encoded secret S′ to compute an encoded output c′.These operations are performed modulo N. The resulting encoded output c′is then decoded using private key p to recover the output message m′ asshown in block 222. The decryption may be performed, for example bygenerating the output message m′ according to the Dec function ofEquation (3) applied to c′, or:m′=Dec(p,c′)=c′(mod p)  Equation (14)

Note that since all of the operations ƒ′₁, ƒ′₂ and ƒ′_(n) are performedon encoded data (e.g. the data is not decoded until all of theoperations ƒ′₁, ƒ′₂ and ƒ′_(n) have been performed), where it isdifficult for an attacker to use the intermediate results of suchcalculations to divine the value of the secret S. This property is madepossible by the homomorphic character of the white-box processingsystem, which permits the operations to be performed on the encoded datarather than requiring the data be decoded before the operations areperformed.

Further, as described above, the order w of the white-box domain W canbe selected to provide the desired level of security. In other words,the larger the domain from which the random prime integers p, q, s andrandom integers rare chosen from, the more security is provided. Forexample, if the numbers p, q and s are of at least w bits in size wherew is much greater than (») b where b is the order of the integral domainB of the original operations ƒ₁, ƒ₂ and ƒ_(n) (i.e., if the inputmessage m may comprise an integer of at least b bits in size), semanticcryptographic security may be obtained.

The operations depicted in FIG. 1A comprise the serial performance offunctions ƒ₁, ƒ₂, and ƒ_(n) (102A, 102B, and 102N, respectively) usingsecret S. The same functions are performed in the fully homomorphicwhite-box implementation 400 depicted in FIG. 4, but are performed inthe white-box domain W, a difference of functionality that is indicatedby ƒ′₁, ƒ′₂ and ƒ′_(n) (102A′, 102B′, and 102N′, respectively).

For exemplary purposes, consider a case where the one or more operationscomprise ƒ₁ and ƒ₂, with ƒ₁ and ƒ₂ defined as follows for inputs (x,y)as follows:ƒ₁(x,y)=x+y  Equation (15)ƒ₂(x,y)=xy  Equation (16)wherein operation ƒ′₁ computes the sum of the encoded input message mand encoded secret S′ modulo N to compute intermediate output, operationƒ′₂ computes the product of the intermediate output and the encodedsecret S′ modulo N to compute the output, which is the encoded outputc′. Hence, each operation ƒ₁, ƒ₂: BλB→B is implemented in the white-boxdomain ƒ′₁, ƒ′₂:WλW→W. Further, as demonstrated below, since thecryptographic operations are homomorphic in both addition andmultiplication, they are fully homomorphic.

While the foregoing example uses two functions ƒ₁ and ƒ₂, a greaternumber of functions may be used while maintaining the homomorphiccharacter of the implementation. Since many other functionalrelationships can be described as various combinations of addition ormultiplication, a wide variety of functions can be implemented with suchcombinations.

Note that since all of the operations ƒ′₁, ƒ′₂ and ƒ′_(n) are performedon encoded data (e.g. the data is not decrypted until all of theoperations ƒ′₁, ƒ′₂ and ƒ′_(n) have been performed), it is difficult foran attacker to use the intermediate results of such calculations todivine the value of the secret S. This property is made possible by thehomomorphic character of the white-box processing system, which permitsthe operations to be performed on the encoded data rather than requiringthe data be decrypted before the operations are performed.

Functional Allocation Among Elements

Importantly, the process of key generation, the encoding of the secretand decoding of any data is performed external to the white-boximplementation 400 and in a secure environment. Further, if the privatekey (p) is to be disseminated to the receiver of the message for use,such dissemination must be performed securely.

For example, if key generation were performed in the white-boximplementation 400 itself, an attacker could intercept the generatedprivate key component (p) and use it to decode any encoded data in thewhite-box implementation 400, including the encoded secret (S). Forexample, if the white-box implementation is of RSA and the secret Srepresents the RSA private key, then an attacker could simply use S innon-white-box RSA to decrypt the input, bypassing the white-boximplementation 400 entirely. Further, with respect to encoding thesecret S (performed by encoder 404′), such encoding of the secret Srequires knowledge of the unencoded secret S. Therefore, if the encodingwere performed on an insecure device, the secret S would be exposedbecause it is an input to the encoding operation. Since the unencodedsecret could be used in a non-white-box version of the cryptosystem tocarry out the original cryptographic operation, the protection affordedby the white-box implementation 400 would be negated. Finally, withrespect to the decoding of data, such decoding requires knowledge of theprivate key (p), and an attacker with knowledge of the private key candecode the encoded secret S and use this in a non-white-box version ofthe cryptosystem to carry out the original cryptographic operation.

Semantic Security

Encryptions can be described as having a property ofindistinguishability. This is described in “A uniform-complexitytreatment of encryption and zero knowledge,” by Oded Goldreich, Journalof Cryptology: The Journal of the International Association forCryptologie Research (IACR), 6(1):21-53, 1993, which is herebyincorporated by reference. The indistinguishability property states thatit is infeasible to find pairs of messages for which an efficient testcan distinguish corresponding encryptions.

An algorithm

may be said to distinguish the random variables R_(n) and S_(n) if

behaves substantially differently when its input is distributed as R_(n)rather than as Sn. Without loss of generality, it suffices to askwhether Pr[

(R_(n))=1] and Pr[

(S_(n))=1] are substantially different.

An encryption scheme (Gen, Enc, Dec) has indistinguishable encryptionsif for every polynomial-time random variable{T_(n)=X_(n)Y_(n)Z_(n)}_(n∈N) with |X_(n)|=|Y_(n)|, every probabilisticpolynomial-time algorithm

, every constant c>0 and all sufficiently large n, and a fixedP←Gen{1^(n)},

$\begin{matrix}{{{{\Pr\left\lbrack {{\left( {Z_{n},{{Enc}\left( {p,X_{n}} \right)}} \right)} = 1} \right\rbrack} - {\Pr\left\lbrack {{\left( {Z_{n},{{Enc}\left( {P,Y_{n}} \right)}} \right)} = 1} \right.}} < \frac{1}{n_{c}}}} & {{Equation}\mspace{14mu}(16)}\end{matrix}$

The probability in the above terms is taken over the probability spaceunderlying T_(n) and the internal coin tosses of the algorithms Gen, Encand

.

It has also been shown that semantic security is equivalent toindistinguishability of encryptions, which allows proof that a WBFHEdescribed above are semantically secure for a sufficiently large whitebox domain W. See, for example “Probabilistic encryption & how to playmental poker keeping secret all partial information,” by ShafiGoldwasser and Silvio Micali, STOC '82 Proceedings of the FourteenthAnnual ACM symposium on Theory of computing, pages 365-377, 1982, whichis hereby incorporated by reference herein. The proof is provided asfollows:

If we choose a random m∈B and public key P←Gen{1^(n)}, and suppose thatan encryption process Enc for two encryptions c₁=Enc(P,m) andc₂=Enc(P,m) is not probabilistic. Then c₁=c₂. But since the encryptionprocess Enc chooses r∈W at random for each encryption,

${{\Pr\left\lbrack {c_{1} = c_{2}} \right\rbrack} = \frac{1}{2^{w}}},$which is negligible. This is a contradiction. Hence, Enc isprobabilistic, and thus if w were sufficiently large, an adversarywithout knowledge of r has a negligible advantage of using knowledge ofEnc to compute the same ciphertext as an oracle implementation ofEnc(P,m).

A connection can also be shown between the WBFHE and the integerfactorization problem, where it is noted that no efficient (polynomialtime) integer factorization algorithm (as discussed in “Number Theoryfor Computing,” by Song Y Yan, Springer Berlin Heidelberg, 2002, herebyincorporated by reference herein. If a PPT algorithm

can factor N=pq or k=s(p−1), then there exists a PPT algorithm

that can invert Enc(P,m). This is apparent because the WBFHE private keyp is a prime factor of N and also (p−1) is a factor of k.

Exemplary Applications

The foregoing principles can be applied to any cryptographic functionhaving one or more cryptographic operations, including digitalsignatures and their use, encryption and decryption. For exemplarypurposes, an application to the decryption of an RSA encrypted messageis described. In this case, the algorithm

is an RSA decryption algorithm. Further, the accepted encoded message isc=Enc(P,M), wherein M is an RSA encrypted version of the input message mencoded with the public key P, and the accepted encoded secret isS′=Enc(P,RSAPVK), wherein RSAPVK is the RSA private key encoded with thepublic key P. In this case, the one or more cryptographic operationscomprise RSA decrypt operations on the encoded input c and the encodedsecret S′ to compute the encoded output c′. Hence, the RSA decryptoperations operate on the encrypted version of the input message M andthe encoded version of the RSA private key, RSAPVK to produce an encodedoutput c′ without exposing the RSA private key, and the original messagem can be recovered using the private key p according to m=Dec(p,c′).

Another exemplary application of the foregoing principles involves thedecryption of programs that have been compressed, for example accordingto an MPEG (motion pictures working guild) standard. Typically, a mediaprogram is compressed, the compressed version of the media programencrypted and thereafter transmitted. The compressed and encrypted mediaprogram is received by the receiver, decrypted, then decompressed. Oncedecrypted, the media program is exposed in compressed form and isvulnerable to compromise before the decompression process. Further, themedia program is exposed in compressed form which is of smaller size andcan be more easily disseminated to unauthorized viewers.

Using the foregoing principles, the media program is also compressedaccording to the MPEG standard, and thereafter encoded or encryptedbefore dissemination. The media program may then be decompressed using ahomomorphic implementation using one or more operations. However, theresulting decompressed media program is still in encoded or encryptedform, and is unviewable until the decoding step is applied. At thispoint, even if the media program were compromised, it would be of muchlarger size and more difficult to disseminate to unauthorized viewers.

Test Results

Tests were performed with a prototype fully homomorphic white-boximplementation (FHWI) written in C++ consisting of 10,000 iteratedadditions and multiplications. The baseline was computed using built-in64 bit integral types. An ESCP VLI library was used for the FHWI largeinteger operations.

FIG. 5 is a diagram presenting a tabular comparison of processing timesfor the baseline white-box implementation illustrated in FIG. 1B, andthe FHWI implementation shown in FIG. 6. Note that the FHWI can takefrom 3.2 to 144 more time to perform an iteration than the baselinewhite-box implementation. Note also that the performance penalty is afunction of w, so w may be chosen to obtain a desired security level,while minimizing processing penalties.

FIG. 6 is a diagram presenting a tabular comparison of the memoryfootprint required to implement the baseline white-box implementationillustrated in FIG. 1B and the FHWI implementation illustrated in FIG.6. Note that the FHWI results in significant footprint reductions (thememory footprint required for the implementation is reduced by a factorof about 64 (w=1024) to 114 (w=128).

Hardware Environment

FIG. 7 is a diagram illustrating an exemplary computer system 700 thatcould be used to implement elements of the present invention, includingthe transmitter 202, receiver 204, processor 206, encoder 404, 404′ anddecryptor 406. The computer 702 comprises a general-purpose hardwareprocessor 704A and/or a special purpose hardware processor 704B(hereinafter alternatively collectively referred to as processor 704)and a memory 706, such as random-access memory (RAM). The computer 702may be coupled to other devices, including input/output (I/O) devicessuch as a keyboard 714, a mouse device 716 and a printer 728.

In one embodiment, the computer 702 operates by the general-purposeprocessor 704A performing instructions defined by the computer program710 under control of an operating system 708. The computer program 710and/or the operating system 708 may be stored in the memory 706 and mayinterface with the user and/or other devices to accept input andcommands and, based on such input and commands and the instructionsdefined by the computer program 710 and operating system 708 to provideoutput and results.

Output/results may be presented on the display 722 or provided toanother device for presentation or further processing or action. In oneembodiment, the display 722 comprises a liquid crystal display (LCD)having a plurality of separately addressable pixels formed by liquidcrystals. Each pixel of the display 722 changes to an opaque ortranslucent state to form a part of the image on the display in responseto the data or information generated by the processor 704 from theapplication of the instructions of the computer program 710 and/oroperating system 708 to the input and commands. Other display 722 typesalso include picture elements that change state in order to create theimage presented on the display 722. The image may be provided through agraphical user interface (GUI) module 718A. Although the GUI module 718Ais depicted as a separate module, the instructions performing the GUIfunctions can be resident or distributed in the operating system 708,the computer program 710, or implemented with special purpose memory andprocessors.

Some or all of the operations performed by the computer 702 according tothe computer program 710 instructions may be implemented in a specialpurpose processor 704B. In this embodiment, some or all of the computerprogram 710 instructions may be implemented via firmware instructionsstored in a read only memory (ROM), a programmable read only memory(PROM) or flash memory within the special purpose processor 704B or inmemory 706. The special purpose processor 704B may also be hardwiredthrough circuit design to perform some or all of the operations toimplement the present invention. Further, the special purpose processor704B may be a hybrid processor, which includes dedicated circuitry forperforming a subset of functions, and other circuits for performing moregeneral functions such as responding to computer program instructions.In one embodiment, the special purpose processor is an applicationspecific integrated circuit (ASIC).

The computer 702 may also implement a compiler 712 which allows anapplication program 710 written in a programming language such as COBOL,C++, FORTRAN, or other language to be translated into processor 704readable code. After completion, the application or computer program 710accesses and manipulates data accepted from I/O devices and stored inthe memory 706 of the computer 702 using the relationships and logicthat was generated using the compiler 712.

The computer 702 also optionally comprises an external communicationdevice such as a modem, satellite link, Ethernet card, or other devicefor accepting input from and providing output to other computers.

In one embodiment, instructions implementing the operating system 708,the computer program 710, and/or the compiler 712 are tangibly embodiedin a computer-readable medium, e.g., data storage device 720, whichcould include one or more fixed or removable data storage devices, suchas a zip drive, floppy disc drive 724, hard drive, CD-ROM drive, tapedrive, or a flash drive. Further, the operating system 708 and thecomputer program 710 are comprised of computer program instructionswhich, when accessed, read and executed by the computer 702, causes thecomputer 702 to perform the steps necessary to implement and/or use thepresent invention or to load the program of instructions into a memory,thus creating a special purpose data structure causing the computer tooperate as a specially programmed computer executing the method stepsdescribed herein. Computer program 710 and/or operating instructions mayalso be tangibly embodied in memory 706 and/or data communicationsdevices 730, thereby making a computer program product or article ofmanufacture according to the invention. As such, the terms “article ofmanufacture,” “program storage device” and “computer program product” or“computer readable storage device” as used herein are intended toencompass a computer program accessible from any computer readabledevice or media.

Of course, those skilled in the art will recognize that any combinationof the above components, or any number of different components,peripherals, and other devices, may be used with the computer 702.

Although the term “computer” is referred to herein, it is understoodthat the computer may include portable devices such as cellphones,portable MP3 players, video game consoles, notebook computers, pocketcomputers, or any other device with suitable processing, communication,and input/output capability.

CONCLUSION

This concludes the description of the preferred embodiments of thepresent invention. The foregoing description of the preferred embodimentof the invention has been presented for the purposes of illustration anddescription. It is not intended to be exhaustive or to limit theinvention to the precise form disclosed. Many modifications andvariations are possible in light of the above teaching.

It is intended that the scope of the invention be limited not by thisdetailed description, but rather by the claims appended hereto. Theabove specification, examples and data provide a complete description ofthe manufacture and use of the apparatus and method of the invention.Since many embodiments of the invention can be made without departingfrom the scope of the invention, the invention resides in the claimshereinafter appended.

What is claimed is:
 1. A method of computing an algorithm

(m,S) with input m and secret S, using one or more white-box encodedoperations, comprising: defining a white-box fully-homomorphic keygeneration function (P,p)←Gen(1^(st)) with public-key P and private-keyp that selects random prime numbers p, q, s∈W of similar size, wherein:B=[0,1]^(b) is the domain of order b, of the algorithm

; W=[0,1]^(w) is a white-box domain of order w, for w»b; p>2^(b) is awhite-box fully-homomorphic private key; N=pq; k=s(p−1); P=(N,k) is awhite-box fully-homomorphic public key; defining a white-boxfully-homomorphic encoding function Enc(P,m):=m^(rk+1)(mod N) thatgenerates a random integers r∈W, then performs an encoding of the inputm∈B; defining a white-box fully-homomorphic decoding functionDec(p,c)=c(mod p) that decodes c by computing modulo p; accepting anencoded input c, where c=Enc(P,m); accepting an encoded secret S′, whereS′=Enc(P,S); performing one or more operations on the encoded input cand the encoded secret S′ modulo N a to obtain an encoded output c′; anddecoding the encoded output c′ with the private key p to recover anoutput m′ according to m′=Dec(p,c′), such that m′=

(m,S).
 2. The method of claim 1, wherein the algorithm

is comprises a decryption algorithm including at least one of anRivest-Shamir-Aldeman (RSA) algorithm, an elliptic curve cryptography(ECC) algorithm, an advanced encryption standard (AES) algorithm, and atriple data standard (TDES) algorithm.
 3. The method of claim 2,wherein: the algorithm

is an RSA decryption algorithm RSADecrypt; the accepted encoded messageis c=Enc(P,M), wherein M=RSAEncrypt(RSAPLK,m) is an RSA encryptedversion of the input message m encoded with the white-boxfully-homomorphic public key P, where (RSAPVK,RSAPLK) is an RSAprivate/public keypair corresponding to the RSAEncrypt and RSAEncryptalgorithms; the accepted encoded secret is S′=Enc(P,RSAPVK), whereinRSAPVK is the RSA private key encoded with the white-boxfully-homomorphic public key P; the one or more operations compriseRSADecrypt implementation, with encoded input c and the encoded secretS′ to compute the encoded output c′; and decoding the encoded output c′with the private key p to recovers the output message m′ according tom′=Dec(p,c′).
 4. The method of claim 1, wherein w is selected forsemantic security.
 5. The method of claim 1, further comprising:securely encoding the input message m according to c=Enc(P,m); andsecurely encoding the secret S according to S′=Enc(P,S).
 6. An apparatusfor computing an algorithm

(m,S) with input m and secret S, using one or more white-box encodedoperations, comprising: means for defining a white-box fully-homomorphickey generation function (P,p)←Gen(1^(st)) with public-key P andprivate-key p that selects random prime numbers p, q, s∈W of similarsize, wherein: B=[0,1]^(b) is the domain of order b, of the algorithm

; W=[0,1]^(w) is a white-box domain of order w, for w»b; p>2^(b) is awhite-box fully-homomorphic private key; N=pq; k=s(p−1); P=(N,k) is awhite-box fully-homomorphic public key; means for defining a white-boxfully-homomorphic encoding function Enc(P,m):=m^(rk+1)(mod N) thatgenerates a random integer r∈w, then performs an encoding of the inputm∈B; means for defining a white-box fully-homomorphic decoding functionDec(p,c):=c(mod p) that decodes c by computing modulo p; a processor; amemory, communicatively coupled to the processor, the memory storingprocessor instructions comprising processor instructions for: acceptingan encoded input c, where c=Enc(P,m); accepting an encoded secret S′,where S′=Enc(P,S); performing one or more operations on the encodedinput and the encoded secret S′ modulo N to obtain an encoded output c′;and decoding the encoded output c′ with the private key p to recover anoutput m′ according to m′=Dec(p,c′), such that m′=

(m,S).
 7. The apparatus of claim 6, wherein the algorithm

comprises a decryption algorithm including at least one of anRivest-Shamir-Aldeman (RSA) algorithm, an elliptic curve cryptography(ECC) algorithm, an advanced encryption standard (AES) algorithm, and atriple data standard (TDES) algorithm.
 8. The apparatus of claim 7,wherein: the algorithm

is an RSA decryption algorithm RSADecrypt; the accepted encoded messageis c=Enc(P,M), wherein M=RSAEncrypt(RSAPLK,m) is an RSA encryptedversion of the input message m encoded with the white-boxfully-homomorphic public key P, where (RSAPVK,RSAPLK) is an RSAprivate/public keypair corresponding to the RSADecrypt and RSAEncryptalgorithms; the accepted encoded secret is S′=Enc(P,RSAPVK), whereinRSAPVK is the RSA private key encoded with the white-boxfully-homomorphic public key P; the one or more operations compriseRSADecrypt implementation, with encoded input c and the encoded secretS′ to compute the encoded output c′; and decoding the encoded output c′with the private key p to recovers the output message m′ according tom′=Dec(p,c′).
 9. The apparatus of claim 6, wherein w is selected forsemantic security.
 10. The apparatus of claim 6, wherein the processorinstructions further comprise processor instructions for: securelyencoding the input message m according to c=Enc(P,m); and securelyencoding the secret S according to S′=Enc(P,S).
 11. A method ofcomputing an algorithm

(m,S) with input m and secret S, using one or more white-box encodedoperations, comprising: accepting an encoded input c, where c=Enc(P,m);accepting an encoded secret S′, where S′=Enc(P,S); performing one ormore operations on the encoded input c and the encoded secret S′ moduloN to obtain an encoded output c′; and decoding the encoded output c′with a private key p to recover an output m′ according to m′=Dec(p,c′),such that m′=

(m,S), wherein: a white-box fully-homomorphic key generation function(P,p)←Gen(1^(st)) is defined with public-key P and the private-key pthat selects random prime numbers p, q, s∈W of similar size, wherein:B=[0,1]^(b) is the domain of order b, of the algorithm

; W=[0,1]^(w) is a white-box domain of order w, for w»b; p>2^(b) is awhite-box fully-homomorphic private key; N=pq; P=(N,k) is a white-boxfully-homomorphic public key; a white-box fully-homomorphic encodingfunction Enc(P,m):=m^(rk+1)(mod N) is defined that generates a randominteger r∈W, then performs an encoding of the input m∈B; a white-boxfully-homomorphic decoding function Dec(p,c):=c(mod p) is defined thatdecodes c by computing c modulo p.
 12. The method of claim 11, whereinthe algorithm A comprises a decryption algorithm including at least oneof an Rivest-Shamir-Aldeman (RSA) algorithm, an elliptic curvecryptography (ECC) algorithm, an advanced encryption standard (AES)algorithm, and a triple data standard (TDES) algorithm.
 13. The methodof claim 12, wherein: the algorithm

is an RSA decryption algorithm RSADecrypt; the accepted encoded messageis c=Enc(P,M), wherein M=RSAEncrypt(RSAPLK,m) is an RSA encryptedversion of the input message m encoded with the white-boxfully-homomorphic public key P, where (RSAPVK,RSAPLK) is an RSAprivate/public keypair corresponding to the RSADecrypt and RSAEncryptalgorithms; the accepted encoded secret is S′=Enc(P,RSAPVK), whereinRSAPVK is the RSA private key encoded with the white-boxfully-homomorphic public key P; the one or more operations compriseRSADecrypt implementation, with encoded input c and the encoded secretS′ to compute the encoded output c′; and decoding the encoded output c′with the private key p to recovers the output message according tom′=Dec(p,c′).
 14. The method of claim 11, wherein w is selected forsemantic security.
 15. The method of claim 11, further comprising:securely encoding the input message m according to c=Enc(P,m); andsecurely encoding the secret S according to S′=Enc(P,S).